Just yesterday there was a thread here, where a random user was added as admin for multiple accounts for GCP accidentally, and he couldn't talk to a human on Google to get it resolved. He was neither actively looking out for nor was not anything other than the average user. OP is correct PGP, is a hassle, and needs explicit knowledge to use it correctly. Keybase somewhat solved it then got unpopular, but thinking about it again even Keybase never went mainstream.

Why not? Many security issues are detected by people who just happened to do a series of actions in a way nobody expected them to do.

You're underestimating how many average people or below-average hackers find/stumble-upon serious vulnerabilities all the time.